Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
springRob WinchSPRING:D910A9047EA53BB42480F75D9C5916E5
HistoryMay 16, 2022 - 5:27 a.m.

CVE-2022-22978: Authorization Bypass in RegexRequestMatcher

2022-05-1605:27:00
Rob Winch
spring.io
377

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

UPDATES

  • [05-17] Due to a mixup CVE-2022-22975 should have been CVE-2022-22978. The blog has been updated to reflect this correction.

CVE-2022-22978 : Authorization Bypass in RegexRequestMatcher

Spring Security 5.7.0, 5.6.4, 5.5.7 were released to fix CVE-2022-22978 : Authorization Bypass in RegexRequestMatcher. Please update as soon as possible.

Related

spring 1
ibm 11
osv 6
cve 3
prion 3
veracode 3
ubuntucve 2
githubexploit 6
nessus 2
redhatcve 2
github 2
qualysblog 1
redhat 3
oracle 4
spring
spring
CVE-2022-22976: BCrypt skips salt rounds for work factor of 31
2022-05-16 05:32:00
ibm
ibm
Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Spring Security
2023-05-17 19:47:18
Security Bulletin: Vulnerability in Spring Security affects IBM Process Mining . CVE-2022-22978
2023-06-27 11:07:53
Security Bulletin: Vulnerabilities in Spring Framework affects IBM Common Licensing's Administration And Reporting Tool (ART) and its Agent (CVE-2022-22978, 220811)
2023-01-30 09:32:36
osv
osv
BIT-pinniped-2022-22975
2024-03-06 11:01:50
CVE-2022-22975
2022-05-11 16:15:08
CVE-2022-22976
2022-05-19 15:15:08
cve
cve
CVE-2022-22975
2022-05-11 16:15:00
CVE-2022-22976
2022-05-19 15:15:00
CVE-2022-22978
2022-05-19 15:15:00
prion
prion
Design/Logic Flaw
2022-05-11 16:15:00
Integer overflow
2022-05-19 15:15:00
Authorization
2022-05-19 15:15:00
veracode
veracode
Integer Overflow
2022-05-20 04:01:08
Privilege Escalation
2022-05-12 05:49:15
Authorization Bypass
2022-05-20 13:00:01
ubuntucve
ubuntucve
CVE-2022-22976
2022-05-19 00:00:00
CVE-2022-22978
2022-05-19 00:00:00
githubexploit
githubexploit
Exploit for Integer Overflow or Wraparound in Vmware Spring Security
2022-05-10 16:36:13
Exploit for Incorrect Authorization in Vmware Spring Security
2023-03-16 09:34:17
Exploit for Incorrect Authorization in Vmware Spring Security
2022-07-13 12:38:26
nessus
nessus
Spring Security < 5.5.7 / 5.6.x < 5.6.4 Authorization Bypass
2023-01-26 00:00:00
Oracle MySQL Enterprise Monitor (Jan 2023 CPU)
2023-01-20 00:00:00
redhatcve
redhatcve
CVE-2022-22976
2022-05-17 16:10:13
CVE-2022-22978
2022-05-18 22:58:31
github
github
Integer overflow in BCrypt class in Spring Security
2022-05-20 00:00:38
Authorization bypass in Spring Security
2022-05-20 00:00:39
qualysblog
qualysblog
Oracle Patch Tuesday April 2023 Security Update Review
2023-04-19 11:47:21
redhat
redhat
(RHSA-2023:3299) Important: jenkins and jenkins-2-plugins security update
2023-05-24 17:06:51
(RHSA-2023:3663) Important: jenkins and jenkins-2-plugins security update
2023-06-19 10:09:14
(RHSA-2022:5532) Important: Red Hat Fuse 7.11.0 release and security update
2022-07-07 14:16:35
oracle
oracle
Oracle Critical Patch Update Advisory - January 2023
2023-01-17 00:00:00
Oracle Critical Patch Update Advisory - October 2022
2022-10-18 00:00:00
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON
Related for SPRING:D910A9047EA53BB42480F75D9C5916E5
spring1ibm11osv6cve3prion3veracode3ubuntucve2githubexploit6nessus2redhatcve2github2qualysblog1redhat3oracle4